Copilot for GCC High: What DIB Contractors Are Asking

Roughly two years after Microsoft Copilot’s Commercial launch, Microsoft 365 Copilot became available to GCC High customers in December 2025. This release represents an important step in bringing enterprise-grade generative AI into Microsoft 365 sovereign cloud environments used by the U.S. Defense Industrial Base (DIB).

Many organizations are asking what this means in practice, from how Microsoft 365 Copilot differs from other Copilot offerings to which features will be limited or unavailable due to the stricter security posture of GCC High. Below are answers to the most frequently asked questions we’re hearing from DIB contractors thus far.

Question: Is Microsoft 365 Copilot available in the GCC / GCC High Clouds?  

Yes. Copilot for Microsoft 365 reached general availability on December 13, 2024 for GCC environments.

For GCC High, Copilot for Microsoft 365 reached general availability in December 2025.

Learn more: 

• Microsoft 365 Copilot is now available in GCC-High 

• Microsoft 365 Roadmap 

Question: Can you help me understand the different flavors/types of Copilot?  

Learn more:  Which flavor of Copilot is right for me or my organization?  

Question: Is Security Copilot available in GCC / GCC High?  

No, Security Copilot is not currently available. Per Microsoft: "Currently, Security Copilot isn't designed for use by customers using US government clouds, including but not limited to GCC, GCC High, DoW, and Microsoft Azure Government."  

Learn more: Are US Government Cloud customers eligible?  

Question: Will I need to purchase additional licensing to use Microsoft 365 Copilot / Copilot Chat?  

Yes and no. Microsoft 365 "Copilot Chat" is available at no additional cost for Entra account users with eligible licenses (e.g., Business Premium, G3, G5, etc.). However, Microsoft 365 Copilot does require an additional per-user (add-on) license.  

Learn more:

• License Options in Microsoft 365 Copilot  

• Microsoft 365 Chat Eligibility  

Question: Microsoft 365 Copilot Chat has "web grounding" OFF by default in GCC High. What does that mean?   

Microsoft 365 Copilot and Microsoft 365 Copilot Chat include a feature called web grounding, which allows Copilot to reference web content when responding to user prompts. This feature improves response quality by incorporating up-to-date information from the web. 

With "web search" enabled, Microsoft 365 Copilot / Copilot Chat will fetch information from the Bing search service when information from the web helps to provide a better, more grounded response. To safeguard against data spillage, Microsoft is disabling this feature by default for GCC High.  

Additional notes:  

• It's important to be aware that with web grounding off, you will experience a Knowledge Cutoff, and Copilot responses may be outdated based on when Large Language Models (LLMs) were last trained.  

• Although Bing is utilized by Copilot when “web search” is enabled, it’s important to clarify that search queries sent to Bing’s search service from Copilot in your tenant have user and tenant identifiers removed.  

Learn more:

• Data, privacy, and security for web search in Microsoft 365 Copilot and Microsoft 365 Copilot Chat 

• Ground Copilot Responses in Latest Data   

Question: Does Microsoft use prompts or query data to improve performance of Bing or train AI models?  

In short, No. Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft 365 Copilot.  

When you enter prompts using Microsoft 365 Copilot, the information contained within your prompts, the data they retrieve, and the generated responses remain within the Microsoft 365 service boundary, in keeping with Microsoft’s current privacy, security, and compliance commitments. Microsoft 365 Copilot uses Azure OpenAI services for processing, not OpenAI’s publicly available services. Azure OpenAI doesn't cache customer content and Copilot modified prompts for Microsoft 365 Copilot.  

Learn more: Data, Privacy, and Security for Microsoft 365 Copilot  

Question: What feature limitations can I expect in GCC High with M365 Copilot vs. Microsoft's Commercial offering?  

For details on feature availability / GCC High specific limitations, please see the Copilot Service Description.   

Here are a few notable limitations:  

• Support for Microsoft 365 Copilot Search  

• Support for Copilot in OneDrive  

• Agent Limitations:  

• • SharePoint agents are not yet supported  

• • Built-in agents such as Researcher and Analyst are not yet available  

• Microsoft 365 Copilot Connectors  

• Power Platform Connectors  

• The Microsoft 365 Copilot app is not available as a Mac desktop app for GCC/GCCH/DoW cloud environments.  

• Teams Meeting Copilot is not yet available.  
• Copilot in Teams chat and channels is not yet available.  

Question: Are there any data-handling or spillage concerns we should plan for before adopting Microsoft 365 Copilot? 

Although Copilot offers tremendous efficiency and productivity gains for an organization, it can also expose underlying data governance issues. When Copilot is introduced, some organizations quickly realize their environment operates less like a house with separate rooms, doors, and access boundaries, and more like a studio apartment where a single entry effectively exposes everything inside. Copilot does not create this visibility into data a user may not need to access; it simply surfaces and connects information far more efficiently than traditional search, making oversharing and weak data governance more apparent. 

As you prepare to adopt Copilot, you should consider hardening your M365 configuration baseline and addressing sources of oversharing and permission drift with principles of least privilege in mind. Some key areas to evaluate include: 

• Improperly labeled or unlabeled content – Sensitive data without appropriate sensitivity labels may be surfaced/summarized in unintended ways. 

• Oversharing / Permission Sprawl – Public M365 Groups, “anyone” links, broad “everyone except external users” access, etc. 

• Stale Content – Inactive or outdated Teams, SharePoint sites, etc. that could result in less accurate responses when interacting with Copilot. 

• Sensitivity Label Support – Microsoft Purview Information Protection (MPIP) usage and Copilot permissions to reason over sensitive data types.